PRELIMINARY AMENDMENT 

New National Stage Entry Appln. of PC17FI03/00332 



AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions and listings of claims in the 

application: 

LISTING OF CLAIMS: 

1. (Currently Amended) A method of storing sensitive information in a system 
comprising two databases, the method comprising at l e ast th e st e ps of : 

receiving a storage request including the information to be stored and a first identifier for 
identifying an individual with whom the information to be stored is associated; 
characterized by 

generating (§0?) a second identifier in such a manner that its value does not depend on 
the first identifier; 

storing (508) the first identifier and the second identifier in the first database in such a 
manner that the first identifier is bound to the second identifier; and 

storing the information to be stored in the second database together with the second 
identifier. 

2. (Currently Amended) A method as claimed in claim 1, characterized by further 
comprising th e st e ps of : 

checking (505) , before generating the second identifier, in the first database if a second 
identifier is generated for the first identifier; 

if so, using the second identifier in the first database; and 
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if not, generating the second identifier. 

3. (Currently Amended) A method as claimed in claim 1 or 2, characterized by further 
comprising th e Gt e ps of : 

receiving a retrieval request including the first identifier; 
retrieving the second identifier corresponding to the first identifier from the first 
database; and 

retrieving the requested information from the second database using the second identifier. 

4. (Currently Amended) A method as claimed in claim 3 , characterized by further 
comprising the a step of sending, to the request, a response including the requested information 
and the first identifier. 

5. (Currently Amended) A telecommunication server (12, 22) in a data system 
comprising at least two databases and a system for generating information to be stored, the 
telecommunication server comprising 

reception means (121) for receiving a request, the request including the information to be 
stored and a first identifier for identifying an individual with whom the information to be stored 
is associated; 

characterized in that th e t e l e communication s e rv e r (12, 22) furth e r compris e s 
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first processing means (122) for determining a second identifier corresponding to the first 
identifier in the first database of the data system, the second identifier being generated in such a 
manner that its value does not depend on the first identifier; and 

second processing means (122) for storing the information to be stored together with the 
second identifier in the second database of the data system. 

6. (Currently Amended) A telecommunication server (12, 22) as claimed in claim 5, 
characterized in that wherein 

the reception means (121) are also arranged to receive a data retrieval request and to 
separate it from the storage request; and 

the second processing means (122) are also arranged to retrieve the data stored together 
with the second identifier from the second database of the data system in response to the data 
retrieval request and to forward the retrieved data without the second identifier to the party 
making the data retrieval request. 

7. (Currently Amended) A telecommunication server (12, 22) in a data system 
comprising at least two databases and a system comprising stored data, the telecommunication 
server comprising 

reception means (121) for receiving a request, the request being associated with the 
stored data and including a first identifier for identifying an individual with whom the stored data 
is associated; 
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characterized in that tho tel e communication s e rv e r furth e r compris e s 

first processing means (122) for determining a second identifier corresponding to the first 

identifier in the first database of the data system, the second identifier being generated in such a 

manner that its value does not depend on the first identifier; and 

second processing means (122) for retrieving the stored data together with the second 

identifier from the second database of the data system. 

8. (Currently Amended) A network node comprising 
a database (DB1) for storing data, and 

reception means (34) for receiving a request directed to the database and for separating a 
first identifier in the request, the first identifier identifying an individual with whom the data to 
be stored is associated; 

characterized in that tho network nod e furth e r compris e s 

generation means £33) for generating a second identifier for the first identifier in such a 
manner that the value of the second identifier does not depend on the first identifier; 

storage means (33) for storing the first identifier and the second identifier in the database 
in such a manner that the first identifier is bound to the second identifier; and 

response means (34) for returning the second identifier in response to the request. 

9. (Currently Amended) A network node as claimed in claim 8, charact e rized in that 
further comprising 
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it further compris e s processing means (33) for checking if the database comprises a 
second identifier for the first identifier, and, if not, to trigger the generation means; and wherein 
the generation means (33) are configured to be responsive to the processing means. 

10. (Currently Amended) A data system comprising 
at least one telecommunication server (12, 22) 
at loaot two databases (DB1, DB2) 
characterized in that 

the at least a first database (DB1) compris e s comprising records wherein a first identifier 
identifying an individual is linked to at least one second identifier, which alone does not identify 
the individual and whose value is generated in such a manner that it does not depend on the first 
identifier; 

the at least a second database (DB2) comprises comprising sensitive information stored in 
such a manner that each piece of personal information is bound to the corresponding second 
identifier; and wherein 

the telecommunication server (12, 22) is arranged to determine a second identifier 
corresponding to the first identifier in the database in response to a request including the first 
identifier, to delete the first identifier from the request, to add the second identifier to the request 
and then to send the request to the second database. 
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